[XMR] Monero Speculation - page 1241.

TheKoziTwo

legendary

Activity: 1552

Merit: 1047

Quote from: noobtrader on July 15, 2016, 01:13:56 PM

Quote from: iCEBREAKER on July 15, 2016, 01:07:22 PM

^^^That is what happens when you don't have a clue, and thus fail.

WOW...

clueless would say... nice wallet you got there bro

Quote from: TheKoziTwo on July 15, 2016, 08:54:26 AM

IMPORTANT ANNOUNCEMENT FOR ALL SERVICE PROVIDERS:

I basically hacked cryptonic.net today as I was able to get their wallet seed and transfer out 2380 XMR. I will of course return the funds to the owner, the only reason I transferred them out is to safe keep them from other potential attackers.

This is something that has been worrying me for a while, but it was only today after receiving a PM from a guy asking for help that I decided to go through the effort. I scanned the monero network, a total of 318 IP's on port 18082. I found 2 matches, and only 1 that I was able to attack. But there could be more vulnerable services out there running on different ports.

When you're running the wallet in rpc mode (you can do that by binding the port) for example like this:

Code:

./simplewallet --wallet-file mywallet.dat --password demo123 --rpc-bind-port 18082

Your wallet will be able to respond to RPC calls. What is very important to know is that the RPC calls are NOT password protected. The password I specified in my example (demo123) only protects the wallet. Once the wallet is running as rpc server it will accept incoming calls. Therefore your port 18082 MUST BE CLOSED (or whatever port you use to run the wallet server). This way you can only access the RPC from localhost.

The RPC has calls like "query_key" where you can retrive view_key or the mnemonic seed. That's what I used, but I could also have used commands like "transfer" to take the funds.

This does not affect normal wallets, only if you run it in server mode like I explained above.

As of right now I'd advise people to wait with purchases on cryptonic until the owner has responded and secured his wallet.

It doesn't appear to be any major issue at the moment as I only found this 1 wallet vulnerable, but again I don't know how many are running servers on different ports and I think it's best this info is out in the open so admins can secure their wallets correctly. It's very simple, just make sure that the port you bind your wallet to is closed.

It's not really a problem with the wallet itself, it works just fine. Perhaps it's rather lack of documentation that is the issue here. In any case it turns out it most likely also requires IP to be bound for this hack to work, which makes it even less likely. When you reach the point that you bind both IP and port and communicate with your wallet from a different server most admins will realize that's not a safe way to do it. This is all about education really, anything can be insecure in the wrong hands. Also 0MQ is in development and will replace the current rpc at some point.

needmoney90

member

Activity: 114

Merit: 10

I was given control of the dormant Monero Slack by CryptoEra, and over the past couple days, I took the liberty of setting up relays between the various endpoints of the Monero Chat Network. There are now links between the official Monero Slack, Telegram group, and IRC channels, anything said in one of those clients can now be read on all the others, and everyone is now chatting in one big room.

Additionally, I've set up an RSS feed channel in Slack, which automatically posts any new threads that appear on /r/Monero and /r/xmrtrader, along with new Github commits on both the Bitmonero (wallet) and Monero-Core (GUI) repositories. If you want to keep tabs on the latest updates, but don't want to constantly be checking the /r/Monero new queue or Github commits, just join the channel, and it will do it automatically for you.

If you want an invite to the Monero Slack, shoot me a PM here or on Reddit (same username there) with your email, and I'll send it out as soon as I can.

TrueCryptonaire

legendary

Activity: 1092

Merit: 1000

Quote from: aminorex on July 15, 2016, 12:18:53 PM

Quote from: TrueCryptonaire on July 15, 2016, 11:19:12 AM

Quote from: s1gs3gv on July 15, 2016, 11:05:48 AM

Quote from: TrueCryptonaire on July 14, 2016, 05:39:05 PM

I agree Monero needs people who are spokesmen and are bringing Monero to the elite.

You don't really want to encourage people to start thinking of XMR as an elitist's coin do you ?

We do not have Forbes guys owning Monero do we?

Of course one can not know with certainty. If they do it is in negligible amounts. Bullish😉

Any owners today are elite by the standards of XMR, since they are among a very few early adopters.

Within that community, XMR has seen a reasonable amount of currency use, but it is definitely too small a community, too loosely knit, to support a meaningful economy. Probably, the overwhelming majority of present currency use is via XMR.to or shapeshift, and hence rather inefficient.

I am dubious of prospects for adoption outside of a few use cases strongly compelling strong privacy, for the time being. Those cases should be more than sufficient for a 1bn USD cap however, at which point wider adoption follows of course. GUI will be necessary but not sufficient for reaching those use cases. Mymonero.com suffices outside the realm of the justly paranoid, but inside is where our next big wins will be found.

Even if a Forbes guy recommends buying Monero it is bullish kal vachomer buys it.
Indeed the period of early adopters is probably until 100 usd/xmr and then we enter to the period of early majority, after that late majority and finally our grandpas.
However, we are pretty far from all of these events.

You were saying you know some use cases (perhaps have contacts also?) for Monero which will lead to 1 bn market cap. How far in the future this lays, let's say, from the day GUI is officially ready and rocks? Do you see it will take weeks, months, years or decades?
The community is also capable to bid Monero pretty high. Monero is so much mined that the current coins used as collateral for Mega leverage will literally make Monero fly high. Imagine, 12 million Moneros collateralized in Polo enabling the leverage of 30 million Moneros (2.5 times)?

noobtrader

legendary

Activity: 1456

Merit: 1000

Quote from: iCEBREAKER on July 15, 2016, 01:07:22 PM

^^^That is what happens when you don't have a clue, and thus fail.

WOW...

clueless would say... nice wallet you got there bro

Quote from: TheKoziTwo on July 15, 2016, 08:54:26 AM

IMPORTANT ANNOUNCEMENT FOR ALL SERVICE PROVIDERS:

I basically hacked cryptonic.net today as I was able to get their wallet seed and transfer out 2380 XMR. I will of course return the funds to the owner, the only reason I transferred them out is to safe keep them from other potential attackers.

This is something that has been worrying me for a while, but it was only today after receiving a PM from a guy asking for help that I decided to go through the effort. I scanned the monero network, a total of 318 IP's on port 18082. I found 2 matches, and only 1 that I was able to attack. But there could be more vulnerable services out there running on different ports.

When you're running the wallet in rpc mode (you can do that by binding the port) for example like this:

Code:

./simplewallet --wallet-file mywallet.dat --password demo123 --rpc-bind-port 18082

Your wallet will be able to respond to RPC calls. What is very important to know is that the RPC calls are NOT password protected. The password I specified in my example (demo123) only protects the wallet. Once the wallet is running as rpc server it will accept incoming calls. Therefore your port 18082 MUST BE CLOSED (or whatever port you use to run the wallet server). This way you can only access the RPC from localhost.

The RPC has calls like "query_key" where you can retrive view_key or the mnemonic seed. That's what I used, but I could also have used commands like "transfer" to take the funds.

This does not affect normal wallets, only if you run it in server mode like I explained above.

As of right now I'd advise people to wait with purchases on cryptonic until the owner has responded and secured his wallet.

It doesn't appear to be any major issue at the moment as I only found this 1 wallet vulnerable, but again I don't know how many are running servers on different ports and I think it's best this info is out in the open so admins can secure their wallets correctly. It's very simple, just make sure that the port you bind your wallet to is closed.

c789

hero member

Activity: 850

Merit: 1000

Quote from: noobtrader on July 15, 2016, 12:57:42 PM

i never heard this happen to other decent coin... does this event really didnt bother you Huh

No it doesn't bother me. As I already stated, the software works correctly. The user is to blame for not using the software correctly. If you want an example of bad software design, look at DAO.

iCEBREAKER

legendary

Activity: 2156

Merit: 1072

Crypto is the separation of Power and State.

Quote from: noobtrader on July 15, 2016, 12:33:40 PM

[cluessless fail]

^^^That is what happens when you don't have a clue, and thus fail.

Quote from: MoneroMooo on July 15, 2016, 11:19:53 AM

works fine here. Either that server was specifically told to listen inbound, or if you can repro it, file a bug with full command line and OS etc.

noobtrader

legendary

Activity: 1456

Merit: 1000

i never heard this happen to other decent coin... does this event really didnt bother you Huh

Quote from: c789 on July 15, 2016, 12:51:01 PM

Quote from: noobtrader on July 15, 2016, 12:33:40 PM

this is waht happenz if you dont have a decent wallet

Quote from: ?? on ??

ups!

Quote from: TheKoziTwo on July 15, 2016, 08:54:26 AM

IMPORTANT ANNOUNCEMENT FOR ALL SERVICE PROVIDERS:

I basically hacked cryptonic.net today as I was able to get their wallet seed and transfer out 2380 XMR. I will of course return the funds to the owner, the only reason I transferred them out is to safe keep them from other potential attackers.

This is something that has been worrying me for a while, but it was only today after receiving a PM from a guy asking for help that I decided to go through the effort. I scanned the monero network, a total of 318 IP's on port 18082. I found 2 matches, and only 1 that I was able to attack. But there could be more vulnerable services out there running on different ports.

When you're running the wallet in rpc mode (you can do that by binding the port) for example like this:

Code:

./simplewallet --wallet-file mywallet.dat --password demo123 --rpc-bind-port 18082

Your wallet will be able to respond to RPC calls. What is very important to know is that the RPC calls are NOT password protected. The password I specified in my example (demo123) only protects the wallet. Once the wallet is running as rpc server it will accept incoming calls. Therefore your port 18082 MUST BE CLOSED (or whatever port you use to run the wallet server). This way you can only access the RPC from localhost.

The RPC has calls like "query_key" where you can retrive view_key or the mnemonic seed. That's what I used, but I could also have used commands like "transfer" to take the funds.

This does not affect normal wallets, only if you run it in server mode like I explained above.

As of right now I'd advise people to wait with purchases on cryptonic until the owner has responded and secured his wallet.

It doesn't appear to be any major issue at the moment as I only found this 1 wallet vulnerable, but again I don't know how many are running servers on different ports and I think it's best this info is out in the open so admins can secure their wallets correctly. It's very simple, just make sure that the port you bind your wallet to is closed.

I don't view that as being negative for simplewallet. It's just like any other software: if you don't know how to use it, it can put you at risk. It's the fault of the user, not of the software. I'll admit I was also running simplewallet incorrectly until now, but that was due to my ignorance. I wouldn't view Apache (or NGINX or Lighttpd) as indecent if I didn't do my part to secure it properly.

c789

hero member

Activity: 850

Merit: 1000

Quote from: noobtrader on July 15, 2016, 12:33:40 PM

this is waht happenz if you dont have a decent wallet

Quote from: ?? on ??

ups!

Quote from: TheKoziTwo on July 15, 2016, 08:54:26 AM

IMPORTANT ANNOUNCEMENT FOR ALL SERVICE PROVIDERS:

I basically hacked cryptonic.net today as I was able to get their wallet seed and transfer out 2380 XMR. I will of course return the funds to the owner, the only reason I transferred them out is to safe keep them from other potential attackers.

This is something that has been worrying me for a while, but it was only today after receiving a PM from a guy asking for help that I decided to go through the effort. I scanned the monero network, a total of 318 IP's on port 18082. I found 2 matches, and only 1 that I was able to attack. But there could be more vulnerable services out there running on different ports.

When you're running the wallet in rpc mode (you can do that by binding the port) for example like this:

Code:

./simplewallet --wallet-file mywallet.dat --password demo123 --rpc-bind-port 18082

Your wallet will be able to respond to RPC calls. What is very important to know is that the RPC calls are NOT password protected. The password I specified in my example (demo123) only protects the wallet. Once the wallet is running as rpc server it will accept incoming calls. Therefore your port 18082 MUST BE CLOSED (or whatever port you use to run the wallet server). This way you can only access the RPC from localhost.

The RPC has calls like "query_key" where you can retrive view_key or the mnemonic seed. That's what I used, but I could also have used commands like "transfer" to take the funds.

This does not affect normal wallets, only if you run it in server mode like I explained above.

As of right now I'd advise people to wait with purchases on cryptonic until the owner has responded and secured his wallet.

It doesn't appear to be any major issue at the moment as I only found this 1 wallet vulnerable, but again I don't know how many are running servers on different ports and I think it's best this info is out in the open so admins can secure their wallets correctly. It's very simple, just make sure that the port you bind your wallet to is closed.

I don't view that as being negative for simplewallet. It's just like any other software: if you don't know how to use it, it can put you at risk. It's the fault of the user, not of the software. I'll admit I was also running simplewallet incorrectly until now, but that was due to my ignorance. I wouldn't view Apache (or NGINX or Lighttpd) as indecent if I didn't do my part to secure it properly.

noobtrader

legendary

Activity: 1456

Merit: 1000

this is waht happenz if you dont have a decent wallet

Quote from: ?? on ??

ups!

Quote from: TheKoziTwo on July 15, 2016, 08:54:26 AM

IMPORTANT ANNOUNCEMENT FOR ALL SERVICE PROVIDERS:

I basically hacked cryptonic.net today as I was able to get their wallet seed and transfer out 2380 XMR. I will of course return the funds to the owner, the only reason I transferred them out is to safe keep them from other potential attackers.

This is something that has been worrying me for a while, but it was only today after receiving a PM from a guy asking for help that I decided to go through the effort. I scanned the monero network, a total of 318 IP's on port 18082. I found 2 matches, and only 1 that I was able to attack. But there could be more vulnerable services out there running on different ports.

When you're running the wallet in rpc mode (you can do that by binding the port) for example like this:

Code:

./simplewallet --wallet-file mywallet.dat --password demo123 --rpc-bind-port 18082

Your wallet will be able to respond to RPC calls. What is very important to know is that the RPC calls are NOT password protected. The password I specified in my example (demo123) only protects the wallet. Once the wallet is running as rpc server it will accept incoming calls. Therefore your port 18082 MUST BE CLOSED (or whatever port you use to run the wallet server). This way you can only access the RPC from localhost.

The RPC has calls like "query_key" where you can retrive view_key or the mnemonic seed. That's what I used, but I could also have used commands like "transfer" to take the funds.

This does not affect normal wallets, only if you run it in server mode like I explained above.

As of right now I'd advise people to wait with purchases on cryptonic until the owner has responded and secured his wallet.

It doesn't appear to be any major issue at the moment as I only found this 1 wallet vulnerable, but again I don't know how many are running servers on different ports and I think it's best this info is out in the open so admins can secure their wallets correctly. It's very simple, just make sure that the port you bind your wallet to is closed.

aminorex

legendary

Activity: 1596

Merit: 1030

Sine secretum non libertas

Quote from: TrueCryptonaire on July 15, 2016, 11:19:12 AM

Quote from: s1gs3gv on July 15, 2016, 11:05:48 AM

Quote from: TrueCryptonaire on July 14, 2016, 05:39:05 PM

I agree Monero needs people who are spokesmen and are bringing Monero to the elite.

You don't really want to encourage people to start thinking of XMR as an elitist's coin do you ?

We do not have Forbes guys owning Monero do we?

Of course one can not know with certainty. If they do it is in negligible amounts. Bullish😉

Any owners today are elite by the standards of XMR, since they are among a very few early adopters.

Within that community, XMR has seen a reasonable amount of currency use, but it is definitely too small a community, too loosely knit, to support a meaningful economy. Probably, the overwhelming majority of present currency use is via XMR.to or shapeshift, and hence rather inefficient.

I am dubious of prospects for adoption outside of a few use cases strongly compelling strong privacy, for the time being. Those cases should be more than sufficient for a 1bn USD cap however, at which point wider adoption follows of course. GUI will be necessary but not sufficient for reaching those use cases. Mymonero.com suffices outside the realm of the justly paranoid, but inside is where our next big wins will be found.

TrueCryptonaire

legendary

Activity: 1092

Merit: 1000

Quote from: s1gs3gv on July 15, 2016, 11:05:48 AM

Quote from: TrueCryptonaire on July 14, 2016, 05:39:05 PM

I agree Monero needs people who are spokesmen and are bringing Monero to the elite.

You don't really want to encourage people to start thinking of XMR as an elitist's coin do you ?

We do not have Forbes guys owning Monero do we?

noobtrader

legendary

Activity: 1456

Merit: 1000

Quote from: nioc on July 15, 2016, 10:59:21 AM

Quote from: Febo on July 15, 2016, 09:40:38 AM

Quote from: nioc on July 15, 2016, 09:18:05 AM

Quote from: owm123 on July 15, 2016, 07:53:28 AM

Quote from: smoothie on July 15, 2016, 12:56:09 AM

I don't know if it's true but somebody mentioned, I believe on reddit, that AA is invested in Zcash.

Does anybody know the answer to the age old question, Is it true?

Never heard about zcash and aa, but aa is known eth investor and supporter. Maybe they meant eth, rather than zcash?

That was me you quoted

I heard one mention about AA & zcash recently from somebody on reddit so I don't know if it's valid hence my question.

In that video right after he dismisses the Monero questions he starts answering DAO questions which are obviously related to eth so....

Of course he was answering DAO question if podcast was made right after DAO hack and was about DAO hack and how ETH will answer on it. Why would he talk or answer on any other question beside about DAO or ETH? He should of course not make fun of his listeners, but that is another question.

On generally on Lets Talk Bitcoin podcasting platform i saw only few podcast at least half of it dedicated to Monero. And most are 2 years old. In few others was mention briefly. Why is so i am not sure. Or Monero is not so interesting or is to hard to understand for them or they do mainly what coin marketers suggest them.

Sorry for not realizing the simple fact the the entire 2+ hours of the show was about dao. I agree with your perspective.

LOL...

shameless shill try to push monero @ exclusive show on eth and dao attack, which obviously put on ignore LOOOLLLLL

s1gs3gv

legendary

Activity: 1316

Merit: 1014

ex uno plures

Quote from: TrueCryptonaire on July 14, 2016, 05:39:05 PM

I agree Monero needs people who are spokesmen and are bringing Monero to the elite.

You don't really want to encourage people to start thinking of XMR as an elitist's coin do you ?

nioc

legendary

Activity: 1624

Merit: 1008

Quote from: Febo on July 15, 2016, 09:40:38 AM

Quote from: nioc on July 15, 2016, 09:18:05 AM

Quote from: owm123 on July 15, 2016, 07:53:28 AM

Quote from: smoothie on July 15, 2016, 12:56:09 AM

I don't know if it's true but somebody mentioned, I believe on reddit, that AA is invested in Zcash.

Does anybody know the answer to the age old question, Is it true?

Never heard about zcash and aa, but aa is known eth investor and supporter. Maybe they meant eth, rather than zcash?

That was me you quoted

I heard one mention about AA & zcash recently from somebody on reddit so I don't know if it's valid hence my question.

In that video right after he dismisses the Monero questions he starts answering DAO questions which are obviously related to eth so....

Of course he was answering DAO question if podcast was made right after DAO hack and was about DAO hack and how ETH will answer on it. Why would he talk or answer on any other question beside about DAO or ETH? He should of course not make fun of his listeners, but that is another question.

On generally on Lets Talk Bitcoin podcasting platform i saw only few podcast at least half of it dedicated to Monero. And most are 2 years old. In few others was mention briefly. Why is so i am not sure. Or Monero is not so interesting or is to hard to understand for them or they do mainly what coin marketers suggest them.

Sorry for not realizing the simple fact the the entire 2+ hours of the show was about dao. I agree with your perspective.

ArticMine

legendary

Activity: 2282

Merit: 1050

Monero Core Team

Quote from: noobtrader on July 15, 2016, 10:41:44 AM

...

thats nonsense, bitcoin can still scale with many other alternative method such as lightning network.
tail emission only make cpu botminer happy.

Proprietary payment channels are not an alternative to scaling the main chain. If I wanted a proprietary payment alternative I would use a bank, or companies such as Visa, PayPal, Western Union etc.

noobtrader

legendary

Activity: 1456

Merit: 1000

Quote from: ArticMine on July 15, 2016, 10:35:31 AM

Quote from: noobtrader on July 15, 2016, 10:23:50 AM

...

how come it was design flaw for bitcoin Huh

... because it has led to Bitcoin having a fixed 1 MB blocksize that has stunted Bitcoin's growth. Monero overcomes this with an adaptive blocksize that allows for growth to meet the market demand for transactions; however the adaptive blocksize in Monero requires a tail emission to ensure that the miners have an incentive to secure the coin, since it is based on a miner penalty that is applied to the base reward. Fees alone cannot be used since fees are used to scale the blocksize by overcoming the base reward penalty.

Edit: Even without scaling it is very unclear that a "fee market: can develop in Bitcoin to secure Bitcoin one the base reward runs out.

thats nonsense, bitcoin can still scale with many other alternative method such as lightning network.
tail emission only make cpu botminer happy.

ArticMine

legendary

Activity: 2282

Merit: 1050

Monero Core Team

Quote from: noobtrader on July 15, 2016, 10:23:50 AM

...

how come it was design flaw for bitcoin Huh

... because it has led to Bitcoin having a fixed 1 MB blocksize that has stunted Bitcoin's growth. Monero overcomes this with an adaptive blocksize that allows for growth to meet the market demand for transactions; however the adaptive blocksize in Monero requires a tail emission to ensure that the miners have an incentive to secure the coin, since it is based on a miner penalty that is applied to the base reward. Fees alone cannot be used since fees are used to scale the blocksize by overcoming the base reward penalty.

Edit: Even without scaling it is very unclear that a "fee market: can develop in Bitcoin to secure Bitcoin one the base reward runs out.

noobtrader

legendary

Activity: 1456

Merit: 1000

Quote from: ArticMine on July 15, 2016, 10:11:22 AM

Quote from: noobtrader on July 15, 2016, 09:41:40 AM

...

i think you were wrong...

i speculate that monero is not good for anything, it has perpetual coin emission which reduce its value that todays 1 xmr =/= monero value @ year 2022.
because if we check 1 bitcoin value it will always == 1 / total.coin(21 M), compared to monero which 1 monero == 1 / total.coin++(M = 264 - 1 PLUS eternal subsidy forever)

which mean if you were holding xmr then the coin value will be reduced eternally forever because the total number of coin is also increased eternally forevaaaaaaaa. Cheesy

The tail emission in Monero, which is under 1% and is simple not compounded, is a very small price to pay in order to have a coin that can scale to meet the market demand for transactions. By the way the inflation rate in Monero will be below the historical inflation rate for gold, and gold is considered the time tested "gold standard" for hard money that retains its value over time.

Edit: Trying to be better than gold in the eyes of Austrian economics is proving to be a serious design flaw of Bitcoin.

how come it was design flaw for bitcoin Huh

ArticMine

legendary

Activity: 2282

Merit: 1050

Monero Core Team

Quote from: noobtrader on July 15, 2016, 09:41:40 AM

...

i think you were wrong...

i speculate that monero is not good for anything, it has perpetual coin emission which reduce its value that todays 1 xmr =/= monero value @ year 2022.
because if we check 1 bitcoin value it will always == 1 / total.coin(21 M), compared to monero which 1 monero == 1 / total.coin++(M = 264 - 1 PLUS eternal subsidy forever)

which mean if you were holding xmr then the coin value will be reduced eternally forever because the total number of coin is also increased eternally forevaaaaaaaa. Cheesy

The tail emission in Monero, which is under 1% and is simple not compounded, is a very small price to pay in order to have a coin that can scale to meet the market demand for transactions. By the way the inflation rate in Monero will be below the historical inflation rate for gold, and gold is considered the time tested "gold standard" for hard money that retains its value over time.

Edit: Trying to be better than gold in the eyes of Austrian economics is proving to be a serious design flaw of Bitcoin.

aminorex

legendary

Activity: 1596

Merit: 1030

Sine secretum non libertas

Quote from: fiscorcle on July 15, 2016, 09:24:31 AM

i've bought in and sold off to monero so many times that i'm loosing the track why monero is so popular in particular 'seasons' when it's pumped and dumped, it has no such real-life purpose as compared to bitcoin, it's so anti-user-friendly that in my pinion most users hold/trade their moneros off exchanges, for me monero is only good for trading...that's all.

Thank you for the liquidity you provide.

Topic: [XMR] Monero Speculation - page 1241. (Read 3314316 times)